Slashdot Mirror
Hackers' 'Zero-Day' Exploits Stay Secret For Ten Months On Average
Sparrowvsrevolution writes "Maybe instead of zero-day vulnerabilities, we should call them -312-day vulnerabilities. That's how long it takes, on average, for software vendors to become aware of new vulnerabilities in their software after hackers begin to exploit them, according to a study presented by Symantec at an Association of Computing Machinery conference in Raleigh, NC this week. The researchers used data collected from 11 million PCs to correlate a catalogue of zero-day attacks with malware signatures taken from those machines. Using that retrospective analysis, they found 18 attacks that represented zero-day exploits between February 2008 and March of 2010, seven of which weren't previously known to have been zero-days. And most disturbingly, they found that those attacks continued more than 10 months on average – up to 2.5 years in some cases – before the security community became aware of them. 'In fact, 60% of the zero-day vulnerabilities we identify in our study were not known before, which suggests that there are many more zero-day attacks than previously thought — perhaps more than twice as many,' the researchers write."
Given a conservative estimate that a new 0-day exploit is found every 2 months, there are at least 5 unpatched exploits in the wild at any given moment.
Somebody should do a comparison.
Wow they are scary numbers. I don't suppose we should be surprised, they want to make use of their exploit and/or they've seen how people are treated if they do point out vulnerabilities.
there should be a lecture about this in elementary school, together with an overview of risks of social networks and place to seek help when being 'cyberbullied' just give those kids a basic understanding of the risks of the things they use (or will use) in everyday life - without demonizing them
If we plot the data, we see a distribution in which some exploits are detected immediately. That's one tail of the distribution. On the other tail, there will be exploits detected so far in the future that they, effectively, will never be detected.
The perfect crime is never detected.
From Wikipedia zero day exploit
For example in 2008 Microsoft confirmed a vulnerability in Internet Explorer, which affected some versions that were released in 2001.[4] The date the vulnerability was first found by an attacker is not known; however, the vulnerability window in this case could have been up to 7 years.
Looks like we've known about this for quite some time
nec sorte nec fato
If software companies were punished for the security holes (or when they leak their databases) then it would become cheaper for them to hire people to fix flaws in house. After all it's easier to find flaws when you have access to the code in the first place. It's not normal that more exploits are found than fixed. It means that more hackers are employed that there should.
http://megafrock.com/cryptex.html
enjoy
lmao captcha hacker
+ Principle of Least Privilege: Sandboxing, Firewalls and so on. Powerpoint has no business in reading C++ and CAD files, for example. See http://de.wikipedia.org/wiki/AppArmor http://de.wikipedia.org/wiki/SELinux
+ Memory Safe Programming Languages: More than 50% of real-world exploits are due to C and C++ and of course the pressure to deliver "something working". Bounds checking, guaranteed pointer validness and proper casting rules would eliminate these 50% of exploits. See http://sourceforge.net/projects/sappeurcompiler/ for an example of an efficient memory-safe language. VMs are not required.
+ Correctness Proofs for certain pieces of software such as crypto libraries, trusted minimal compilers, trusted minimal operating systems. Examples: http://www.sigops.org/sosp/sosp09/papers/klein-sosp09.pdf , http://compcert.inria.fr/download.html
+ Managed Security Monitoring: Monitoring a firewall for suspicious traffic requires a lot of speciality knowledge and bespoke analysis scripts to filter out innocuous traffic and leave the suspicious stuff to human experts for investigation. This specialty function is probably best done by specialized companies who do that as their core business. Of course, the firewall must be a completely separate, independent device sitting between the potential targets of an attack and the general internet. A Raspberry PI-class of computer could probably do the job for home users.
The bottom line is that "fixing bugs in application code" won't properly attack this problem. There must be a comprehensive, concerted effort to shore up the defences or computers will be regarded as insecure toys and users will go back to pen and paper for anything confidential. And that means lots of IT professionals will get the boot. So we better get our heads out of our assess and implement systematically better security techniques.
for the lulz
Brought to you by Symantec, the company that makes a living of (exclusively) selling remedies to security holes.
So, certainly neutral approach.
Herve S.
..because the intelligent reader will figure that virus scanners won't help much against these "secret 0-day exploits". Of course, most intelligent IT pros have figured that a long time ago, but this kind of message just reinforces it. Virus scanners are a SCAM.
When you release something as open source, your reputation is on the line as everybody can inspect your coding. That in turn forces developers to be much more diligent.
Commercial software, on the other hand, is often a stinking heap of nasty and un-reviewed code. Managers regard it as a waste of resources to do proper code reviews (and consequential cleanups), because "that does not contribute to the development of new features which can be sold for $$$". And because most managers are proud to be ignorant dumbasses.
... there have been even older, much more critical bugs in Windows. Think of the "icon image resource" exploit, which probably existed since Windows 3.1. That would be something like 17 or more years.
Most designations like "zero-day" assume that hacking is like academia and usually only one person discovers a vulnerability at a time. More likely, many people stumble across it in the course of doing other things, and trade it as a favor to other IT professionals or hackers. Those in turn trade it down the line until it gets to someone who uses it for evil.
I bet if you surveyed IT professionals, you will find that 90% of us have circumvented security in order to make necessary repairs or alterations at some time or another. It's a nobody's fault type situation; often you're waiting for a system to be upgraded, or integrated, or working your way around older hardware or software. The shortest distance between two points is through the security wall.
"One aspect of zero-day exploits use that's made them tough to track and count has been how closely targeted they are. Unlike the mass malware infections that typically infect many thousands of machines using known vulnerabilties, the majority of the exploits in Symantec's study only affected a handful of machines--All but four of the exploits infected less than 100 targets, and four were found on only one computer.
What OS do these machines run on?
AccountKiller
CTRL- For "Systematic Security Measures " after having loaded all messages on this page.
...seven of which weren't previously known to have been zero-days
Aren't all attacks and exploits zero-days, at least on the first day?
If they just wait 2 more days (per the sumary) it can be a PI day vulnerability at 314 days.
Then everyone would take security seriously protecting their pi. I mean even the Amish have Pie safes.
When I was your age we didn't have music file sharing utilities. We had to go out to a store and shoplift the CD.
And yet time and time again, we have people arguing that the responsible thing is to let the vendor sit on the bug report for months, while their customers get infected.
This is exactly my reasons for arguing full disclosure. You need to inform the customers which software to block from the net by any means possible (which is then up to the customers' IT department) immediately, without caring about the reputation of the vendor. Hiding the bug report is only going to help anyone, if you know for sure that nobody else has found the same hole, and that would require labeling yourself the smartest person on the planet. The safe thing to do is to assume that somebody else is smarter than you, and probably already knows about the hole.
i thought the security community is a group of people concerned about the same thing. here it seems to be large corporations dictating what should be done, however they are unable to write a program without holes, unfinished code, and security vulnerabilities itself. i do not understand why they still have so much business. as an AV, its nearly the worst, as a firewall, it is the worst. i prefer an AV that doesn't have system requirements higher than some games.
if i am wrong about what the security community is, please let me know.
Because if someone behaves and looks like a troll, I'm not going to pay attention long enough to find out if the bug report is valid.
In the US, shooting the messenger is the standard in vulnerability disclosure. As such, in the past 5 years most researchers just give up on responsible disclosure, I mean, why bother?
The good deed you are doing will be met with adverse reaction by the non-technical public, the press and law enforcement. That's a risk researchers just cannot risk, better to just use your research for your own purposes; commercial, nefarious or otherwise, than risk spending 1-10 years in federal pound me in the ass lockup. Hell, even the government doesn't give a shit about responsible disclosure, look at Stuxnet, we know it had 0 days and we believe it was government backed, where was the responsible disclosure there? Government leaving millions at risk and no one holds them accountable?
"Which seemingly begs the question, why are we running AV?" - by mcgrew (92797) * on Wednesday October 17, @10:21AM (#41680767) Journal
See subject-line: It's 1 thing that HELPS, since if it "smells like a duck, tastes like a duck, & sounds like a duck? Pretty good chance it's a duck!" (replace duck with malware)...
Every bit helps! So, IF your antivirus of choice isn't set BY DEFAULT (most aren't iirc) to use its highest level of heuristic detection?? Set it so!
* False positives are a risk here though... the only downside.
---
"AV is clearly useless." - by mcgrew (92797) * on Wednesday October 17, @10:21AM (#41680767) Journal
Come on mcgrew - that's NOT TRUE, & you know it!
---
"It seems the UAC is far better at keeping your equipment free of viruses.." - by mcgrew (92797) * on Wednesday October 17, @10:21AM (#41680767) Journal
Agreed, it's great stuff... & even BETTER, if you set it up on Windows so it's like on a MacOS X rig - meaning ANYTHING you install needs ADMINISTRATOR GROUP LEVEL people installing... &, it's VERY EASY to setup, thus:
The settings to examine & change are as follows in gpedit.msc &/or regedit.exe:
---
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Admin Approval Mode for the Built-in Administrator account
OR
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v FilterAdministratorToken
(Set as ENABLED)
---
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode
OR
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin
(Set as PROMPT FOR CREDENTIALS)
---
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for standard users
OR
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorUser
(Set as Automatically deny elevation requests)
---
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Detect application installations and prompt for elevation
OR
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableInstallerDetection
(Set as ENABLED)
---
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Only elevate UIAccess applications that are installed in secure locations
OR
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableSecureUIAPaths
(Set as ENABLED)
---
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Run all administrators in Admin Approval Mode
OR
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
(Set as ENABLED)
---
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Switch to the secure desktop when prompting for elevation
OR
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop
(Set as ENABLED)
---
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Virtualize file and registry write failures to per-user locations
OR
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableVirtualization
(Set as ENABLED)
---
Computer Configuration\Windows
Hackers reportedly hailing from Communist China have made an entrance into the Cuban ICBM Missile Sites in order to gain remote control of the ACCESS LAUNCH PROCEDURE PROTOCOL (ALPP). Speculators say a 0-Day Vulnerability in the SSL Protocol was used to compromise the machines.
...and computer security was published in a recent report from the European Network and Information Security Agency indicating that banks should always assume their client computers are infected.
I started moving the PC's I "maintain" (parents etc.) away from Windows and to a separate Ubuntu partition *only* for banking for this very reason. The likelihood that that partition is vulnerable (different OS, no other internet tooling running on it) is significantly lower.
At the same time, banks start drawing lines on what they do and do not reimburse to their clients based on e.g. their computers' security state and their client's intellect (giving out pin codes to perfect strangers...). While the latter is quite logical, the former is starting to become an issue: some banks insist that clients (especially business clients) did not take enough precautions against an attack. Of course not all attacks can be prevented in the first place, as TFA indicates. So, better be safe(r) than sorry and protect your banking as much as you can. (Situation is from The Netherlands BTW, with ABN Amro and Rabobank as some of the examples of banks that start questioning their clients security behaviour, positively or negatively).
Slashdot: stuff for news, nerds that matter, matter for news, stuff that nerd